[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.57' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program syzkaller login: [ 66.406033][ T6813] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.413031][ T6818] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.424203][ T6819] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.424255][ T6820] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.432836][ T6821] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.444697][ T6822] netlink: 'syz-executor817': attribute type 3 has an invalid length. [ 66.449339][ T6813] netlink: 'syz-executor817': attribute type 8 has an invalid length. [ 66.457255][ T6822] netlink: 'syz-executor817': attribute type 8 has an invalid length. [ 66.467382][ T6819] netlink: 'syz-executor817': attribute type 8 has an invalid length. [ 66.478214][ T6818] netlink: 'syz-executor817': attribute type 8 has an invalid length. [ 66.482967][ T6821] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. executing program executing program [ 66.491462][ T6820] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. [ 66.500722][ T6813] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. [ 66.510363][ T6818] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. [ 66.521581][ T6819] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. [ 66.529657][ T6822] netlink: 16602 bytes leftover after parsing attributes in process `syz-executor817'. [ 66.551343][ T6818] ================================================================== [ 66.559571][ T6818] BUG: KASAN: vmalloc-out-of-bounds in nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.568072][ T6818] Read of size 4 at addr ffffc90003d2f018 by task syz-executor817/6818 [ 66.576306][ T6818] [ 66.578663][ T6818] CPU: 1 PID: 6818 Comm: syz-executor817 Not tainted 5.8.0-rc1-syzkaller #0 [ 66.587308][ T6818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.597387][ T6818] Call Trace: [ 66.600661][ T6818] dump_stack+0x18f/0x20d [ 66.605026][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.610601][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.616140][ T6818] print_address_description.constprop.0.cold+0x5/0x436 [ 66.623100][ T6818] ? check_preemption_disabled+0x38/0x220 [ 66.628810][ T6818] ? vprintk_func+0x97/0x1a6 [ 66.633423][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.638993][ T6818] kasan_report.cold+0x1f/0x37 [ 66.643741][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.649268][ T6818] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 66.654669][ T6818] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 66.660641][ T6818] ? __kmalloc_node_track_caller+0x38/0x60 [ 66.666441][ T6818] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.673217][ T6818] ? __phys_addr+0x9a/0x110 [ 66.677717][ T6818] ? memset+0x20/0x40 [ 66.681684][ T6818] genl_lock_dumpit+0x7f/0xb0 [ 66.686355][ T6818] netlink_dump+0x4cd/0xf60 [ 66.690844][ T6818] ? netlink_insert+0x1670/0x1670 [ 66.695847][ T6818] ? __mutex_unlock_slowpath+0xe2/0x610 [ 66.701378][ T6818] ? genl_start+0x45a/0x6e0 [ 66.705865][ T6818] __netlink_dump_start+0x643/0x900 [ 66.711043][ T6818] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.715714][ T6818] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 66.722477][ T6818] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 66.728199][ T6818] ? genl_rcv+0x40/0x40 [ 66.732356][ T6818] ? mutex_lock_io_nested+0xf60/0xf60 [ 66.737711][ T6818] ? mark_lock+0xbc/0x1710 [ 66.742119][ T6818] ? genl_rcv_msg+0x9e0/0x9e0 [ 66.746788][ T6818] ? genl_unlock+0x20/0x20 [ 66.751184][ T6818] ? genl_parallel_done+0x170/0x170 [ 66.756364][ T6818] ? __radix_tree_lookup+0x1f3/0x290 [ 66.761634][ T6818] genl_rcv_msg+0x797/0x9e0 [ 66.766136][ T6818] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.773054][ T6818] ? lock_acquire+0x1f1/0xad0 [ 66.777710][ T6818] ? genl_rcv+0x15/0x40 [ 66.781870][ T6818] ? lock_release+0x8d0/0x8d0 [ 66.786557][ T6818] netlink_rcv_skb+0x15a/0x430 [ 66.791306][ T6818] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 66.798221][ T6818] ? netlink_ack+0xa10/0xa10 [ 66.802814][ T6818] genl_rcv+0x24/0x40 [ 66.806796][ T6818] netlink_unicast+0x533/0x7d0 [ 66.811593][ T6818] ? netlink_attachskb+0x810/0x810 [ 66.816743][ T6818] ? _copy_from_iter_full+0x247/0x890 [ 66.822109][ T6818] ? __phys_addr_symbol+0x2c/0x70 [ 66.827127][ T6818] ? __check_object_size+0x171/0x3e4 [ 66.832451][ T6818] netlink_sendmsg+0x856/0xd90 [ 66.837244][ T6818] ? netlink_unicast+0x7d0/0x7d0 [ 66.842194][ T6818] ? netlink_unicast+0x7d0/0x7d0 [ 66.847119][ T6818] sock_sendmsg+0xcf/0x120 [ 66.851517][ T6818] ____sys_sendmsg+0x6e8/0x810 [ 66.856295][ T6818] ? kernel_sendmsg+0x50/0x50 [ 66.860961][ T6818] ? do_recvmmsg+0x6d0/0x6d0 [ 66.865531][ T6818] ? release_pages+0x641/0x17a0 [ 66.870379][ T6818] ___sys_sendmsg+0xf3/0x170 [ 66.874951][ T6818] ? sendmsg_copy_msghdr+0x160/0x160 [ 66.880253][ T6818] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 66.886305][ T6818] ? check_preemption_disabled+0x38/0x220 [ 66.892046][ T6818] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 66.898141][ T6818] ? handle_mm_fault+0xad9/0x4420 [ 66.903165][ T6818] ? __fget_light+0x215/0x280 [ 66.907834][ T6818] __sys_sendmsg+0xe5/0x1b0 [ 66.912339][ T6818] ? __sys_sendmsg_sock+0xb0/0xb0 [ 66.917394][ T6818] ? check_preemption_disabled+0x38/0x220 [ 66.923101][ T6818] ? do_syscall_64+0x1c/0xe0 [ 66.927668][ T6818] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 66.933639][ T6818] do_syscall_64+0x60/0xe0 [ 66.938058][ T6818] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 66.943952][ T6818] RIP: 0033:0x441319 [ 66.947817][ T6818] Code: Bad RIP value. [ 66.951874][ T6818] RSP: 002b:00007ffd58392bf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 66.960259][ T6818] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319 [ 66.968217][ T6818] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 66.976173][ T6818] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 66.984263][ T6818] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402090 [ 66.992224][ T6818] R13: 0000000000402120 R14: 0000000000000000 R15: 0000000000000000 [ 67.000222][ T6818] [ 67.002531][ T6818] [ 67.004834][ T6818] Memory state around the buggy address: [ 67.010442][ T6818] ffffc90003d2ef00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.018481][ T6818] ffffc90003d2ef80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.026530][ T6818] >ffffc90003d2f000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.034589][ T6818] ^ [ 67.039417][ T6818] ffffc90003d2f080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 [ 67.047475][ T6818] ffffc90003d2f100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 executing program executing program [ 67.055578][ T6818] ================================================================== [ 67.063630][ T6818] Disabling lock debugging due to kernel taint [ 67.070437][ T6818] Kernel panic - not syncing: panic_on_warn set ... [ 67.077044][ T6818] CPU: 1 PID: 6818 Comm: syz-executor817 Tainted: G B 5.8.0-rc1-syzkaller #0 [ 67.087098][ T6818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.097161][ T6818] Call Trace: [ 67.100461][ T6818] dump_stack+0x18f/0x20d [ 67.104801][ T6818] ? nl802154_dump_wpan_phy+0x940/0x9c0 [ 67.110340][ T6818] panic+0x2e3/0x75c [ 67.114225][ T6818] ? __warn_printk+0xf3/0xf3 [ 67.118884][ T6818] ? preempt_schedule_common+0x59/0xc0 [ 67.124325][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.129848][ T6818] ? preempt_schedule_thunk+0x16/0x18 [ 67.135241][ T6818] ? trace_hardirqs_on+0x55/0x220 [ 67.140256][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.145801][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.151334][ T6818] end_report+0x4d/0x53 [ 67.155489][ T6818] kasan_report.cold+0xd/0x37 [ 67.160147][ T6818] ? nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.165688][ T6818] nl802154_dump_wpan_phy+0x98e/0x9c0 [ 67.171048][ T6818] ? kmem_cache_alloc_node_trace+0x3b0/0x400 [ 67.177014][ T6818] ? __kmalloc_node_track_caller+0x38/0x60 [ 67.182815][ T6818] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.189558][ T6818] ? __phys_addr+0x9a/0x110 [ 67.194060][ T6818] ? memset+0x20/0x40 [ 67.198028][ T6818] genl_lock_dumpit+0x7f/0xb0 [ 67.202692][ T6818] netlink_dump+0x4cd/0xf60 [ 67.207179][ T6818] ? netlink_insert+0x1670/0x1670 [ 67.212188][ T6818] ? __mutex_unlock_slowpath+0xe2/0x610 [ 67.217719][ T6818] ? genl_start+0x45a/0x6e0 [ 67.222210][ T6818] __netlink_dump_start+0x643/0x900 [ 67.227390][ T6818] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.232062][ T6818] ? nl802154_send_wpan_phy.constprop.0+0x21d0/0x21d0 [ 67.238821][ T6818] genl_family_rcv_msg_dumpit+0x2ac/0x310 [ 67.244530][ T6818] ? genl_rcv+0x40/0x40 [ 67.248667][ T6818] ? mutex_lock_io_nested+0xf60/0xf60 [ 67.254017][ T6818] ? mark_lock+0xbc/0x1710 [ 67.258410][ T6818] ? genl_rcv_msg+0x9e0/0x9e0 [ 67.263065][ T6818] ? genl_unlock+0x20/0x20 [ 67.267460][ T6818] ? genl_parallel_done+0x170/0x170 [ 67.272653][ T6818] ? __radix_tree_lookup+0x1f3/0x290 [ 67.277933][ T6818] genl_rcv_msg+0x797/0x9e0 [ 67.282430][ T6818] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.289359][ T6818] ? lock_acquire+0x1f1/0xad0 [ 67.294040][ T6818] ? genl_rcv+0x15/0x40 [ 67.298173][ T6818] ? lock_release+0x8d0/0x8d0 [ 67.302832][ T6818] netlink_rcv_skb+0x15a/0x430 [ 67.307574][ T6818] ? genl_family_rcv_msg_attrs_parse.isra.0+0x310/0x310 [ 67.314499][ T6818] ? netlink_ack+0xa10/0xa10 [ 67.319084][ T6818] genl_rcv+0x24/0x40 [ 67.323047][ T6818] netlink_unicast+0x533/0x7d0 [ 67.327809][ T6818] ? netlink_attachskb+0x810/0x810 [ 67.332898][ T6818] ? _copy_from_iter_full+0x247/0x890 [ 67.338265][ T6818] ? __phys_addr_symbol+0x2c/0x70 [ 67.343264][ T6818] ? __check_object_size+0x171/0x3e4 [ 67.348531][ T6818] netlink_sendmsg+0x856/0xd90 [ 67.353285][ T6818] ? netlink_unicast+0x7d0/0x7d0 [ 67.358205][ T6818] ? netlink_unicast+0x7d0/0x7d0 [ 67.363119][ T6818] sock_sendmsg+0xcf/0x120 [ 67.367510][ T6818] ____sys_sendmsg+0x6e8/0x810 [ 67.372248][ T6818] ? kernel_sendmsg+0x50/0x50 [ 67.376898][ T6818] ? do_recvmmsg+0x6d0/0x6d0 [ 67.381462][ T6818] ? release_pages+0x641/0x17a0 [ 67.386291][ T6818] ___sys_sendmsg+0xf3/0x170 [ 67.390872][ T6818] ? sendmsg_copy_msghdr+0x160/0x160 [ 67.396154][ T6818] ? do_huge_pmd_anonymous_page+0x1b94/0x2230 [ 67.402216][ T6818] ? check_preemption_disabled+0x38/0x220 [ 67.407927][ T6818] ? do_huge_pmd_anonymous_page+0x8ef/0x2230 [ 67.413900][ T6818] ? handle_mm_fault+0xad9/0x4420 [ 67.418914][ T6818] ? __fget_light+0x215/0x280 [ 67.423569][ T6818] __sys_sendmsg+0xe5/0x1b0 [ 67.428049][ T6818] ? __sys_sendmsg_sock+0xb0/0xb0 [ 67.433066][ T6818] ? check_preemption_disabled+0x38/0x220 [ 67.438775][ T6818] ? do_syscall_64+0x1c/0xe0 [ 67.443341][ T6818] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 67.449308][ T6818] do_syscall_64+0x60/0xe0 [ 67.453720][ T6818] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 67.459602][ T6818] RIP: 0033:0x441319 [ 67.463468][ T6818] Code: Bad RIP value. [ 67.467543][ T6818] RSP: 002b:00007ffd58392bf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 67.475952][ T6818] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441319 [ 67.483904][ T6818] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003 [ 67.491877][ T6818] RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 [ 67.499833][ T6818] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000402090 [ 67.507797][ T6818] R13: 0000000000402120 R14: 0000000000000000 R15: 0000000000000000 [ 67.516842][ T6818] Kernel Offset: disabled [ 67.521163][ T6818] Rebooting in 86400 seconds..